IT Daily Roundup – September 25, 2026
1. WordPress CVE-2026-87902 – Unauthenticated RCE Actively Exploited, Patch in Version 7.1.2
Security researchers have confirmed active exploitation of CVE-2026-87902 (CVSS 9.2) in WordPress Core – a critical remote code execution vulnerability that requires no attacker authentication. The flaw lies in how WordPress resolves page templates: if the active theme contains a top-level directory with a name starting with "page-" (a common WordPress convention) and a readable PHP file such as pearcmd.php exists on the server, an attacker can include that file outside the standard theme directories and execute arbitrary code on the server. Confirmed exploits in the wild involve writing files to temporary directories, deploying PHP upload scripts, and using GitHub-hosted web shells for lateral movement through compromised systems. WordPress has released patches in versions 7.1.2, 7.0.6, 6.9.9, and 6.8.10; while WordPress typically auto-updates core, an explicit check is strongly advised.
Why this matters: WordPress powers the websites of a large portion of SMEs, and this is already the third critical WordPress Core vulnerability in the span of a few days. Attackers are actively scanning the internet for vulnerable installations – this threat is live, not theoretical. Check your WordPress version (Settings → About WordPress in the admin panel) and confirm you are running 7.1.2 or newer. If you manage WordPress sites for clients or run multiple installations, today is the day to audit the entire portfolio.
2. TeamFiltration – 5,700 Microsoft 365 Accounts Targeted, 7 Compromised via Default Passwords Without MFA
Proofpoint documented the UNK_CondorFiltration campaign, which between July and August 2026 targeted over 5,700 Microsoft 365 accounts across 28 tenants – primarily in Chilean retail and financial sectors. Attackers used the open-source TeamFiltration tool, designed for systematic enumeration, password spraying, exfiltration, and backdooring of Entra ID accounts, leveraging 1,487 unique AWS EC2 source IP addresses. All seven compromised accounts were service or functional accounts – not individual employee accounts – and six of them were compromised within 7 minutes, indicating shared default passwords that had never been changed since initial provisioning. After gaining access, attackers accessed Office, OneDrive, Teams, Azure Portal, and SharePoint Online and used German VPN nodes to further probe corporate infrastructure.
Why this matters: Service and functional accounts (integrations, automations, legacy applications, test environments) are a chronically underestimated security gap: IT teams create them, assign a default password, and forget about them. This campaign exploited exactly that pattern. The recommended approach for every company using Microsoft 365: audit service and functional accounts in Entra ID (Azure AD), verify which ones have MFA enabled, change all default and long-unchanged passwords, and consider disabling accounts no longer in active use. If an external IT provider manages your Microsoft 365 tenant, request a report of all active service accounts including MFA status and last sign-in date.
3. AI-Assisted Code Leaks Secrets at Double the Rate – GitGuardian 2026 State of Secrets Sprawl Report
The GitGuardian 2026 State of Secrets Sprawl report found that commits identified as AI-assisted leak sensitive credentials (API keys, authentication tokens, service account credentials) at approximately twice the rate of human-written code. A key shift: the fastest-growing categories of leaked credentials are now access keys to AI services themselves – OpenAI API keys, Anthropic tokens, Azure OpenAI credentials. AI assistants and agents spread credentials across a greater number of systems (repositories, CI/CD variables, documentation, ticketing systems, collaboration platforms) than traditional development, dramatically expanding the exposure surface far beyond the source code itself.
← All postsWhy this matters: For SMEs integrating AI tools (GitHub Copilot, Cursor, Claude, ChatGPT) into their development workflow or business process automation, this is a practical warning signal. An OpenAI or Azure OpenAI API key embedded in source code can lead to unauthorized charges on your account, leakage of business data, or compromise of your entire CI/CD pipeline. The remediation is straightforward even for smaller teams: never store API keys directly in code – use secrets management (GitHub Secrets, Azure Key Vault, .env files outside the repository), set up automatic credential rotation, and extend credential leak scanning beyond repositories to CI/CD systems and collaboration tools as well.